Data Processing Agreement

This Data Processing Agreement (hereinafter the “ETD” or “DPA”) is an addendum to the Meo Terms of Use (the “Terms”) entered into between 9553-6785 Québec Inc., a company incorporated under the laws of Quebec, which operates the Meo document management software (hereinafter “Meo”, “we” or the “Mandatary”), and the entity that accepted the Terms (hereinafter the “Client” or the “Mandator”).

This DPA applies when Meo processes Personal Information on behalf of the Client in the course of providing the Services. Its purpose is to ensure that this processing complies with the Act respecting the protection of personal information in the private sector (chapter P-39.1), as amended by Law 25 (SQ 2021, c. 25), and that it respects the rights of the individuals concerned.

For the purposes of this DPA, the parties acknowledge that:

4.1 Object and purpose: Meo processes Client Data only for the following purposes: secure document storage, management of document requests and client portals, encryption, backup, access logging, and any feature inherent to the Services as described in the Terms.

4.2 Categories of individuals concerned: The individuals whose Personal Information may be processed include:

• The Client's clients
• The Client's employees
• The Client's external collaborators
• Any natural person whose information appears in the documents uploaded to Meo

4.3 Types of personal information: The types of information that may be processed include, without limitation:

• Names, addresses, telephone numbers, email addresses
• Identification numbers
• Financial and tax information
• Any other personal information contained in the documents uploaded by the Client

4.4 Duration of the processing: Processing starts on the date the Client's account is activated and ends in accordance with section 12 of this DPA.

In accordance with section 18.3 of P-39.1, Meo undertakes the following obligations:

5.1 Purpose limitation: Meo processes Client Data exclusively in the performance of this contract for services and for the provision of the Services.

5.2 Confidentiality protection measures: In accordance with section 18.3, paragraph 2, subparagraph (2) of P-39.1, Meo implements and maintains the following technical and organizational measures:

5.2.5 Organizational security: All Meo personnel are bound by contractual confidentiality obligations. Meo is in the process of achieving SOC 2 Type 2 compliance. A Cloudflare web application firewall (WAF) is in place to protect against threats.

5.3 Personnel confidentiality: Meo ensures that every person authorized to process Client Data is subject to a contractual confidentiality obligation and has received adequate training on the protection of personal information.

In accordance with section 18.3, paragraph 2, subparagraph (2) of P-39.1, Meo undertakes to notify the Client's privacy officer for the protection of personal information without delay of any violation or attempted violation of the obligations relating to the confidentiality of Client Data.

6.1 Content of the notification: The notification will include, to the extent the information is available:

• The nature of the Confidentiality Incident
• The categories and approximate number of individuals concerned
• A description of the Personal Information involved
• An assessment of the risk of injury to the individuals concerned
• The measures taken or contemplated to mitigate the consequences

6.2 Cooperation: Meo will provide reasonable cooperation to the Client so that it can meet its own notification obligations towards the CAI and the individuals concerned (sections 3.5 to 3.8 of P-39.1).

6.3 Register of incidents: Meo maintains a register of confidentiality incidents in accordance with section 3.8 of P-39.1, kept for a minimum period of five (5) years.

In accordance with section 18.3, paragraph 2, subparagraph (2) of P-39.1, Meo allows the Client's Privacy Officer to carry out any verification relating to compliance with the confidentiality obligations set out in this DPA.

7.1 Procedure

• The Client may request, once (1) per twelve (12) month period, a verification of Meo's compliance with the obligations of this DPA.
• The request must be made in writing, with reasonable advance notice of at least thirty (30) days.
• The verification may take the form of a written questionnaire, a documentary review, or an audit conducted by an independent third party chosen by mutual agreement.
• Meo will make available to the Client its SOC 2 compliance reports (when available), its penetration test reports, and any other relevant documentation.

7.2 Confidentiality of the results: The results of any verification are treated as confidential information of Meo and may not be disclosed to third parties without Meo's written consent, unless the law requires it.

8.1 General authorization: The Client authorizes Meo to use the Subsequent Vendors listed below for the provision of the Services.

8.2 Meo's obligations towards its vendors: Before entrusting the processing of Client Data to a Subsequent Vendor, Meo makes sure that:

• A written contract imposing at least equivalent protection obligations is in place
• The level of protection offered is equivalent to or higher than the level required by Applicable Law
• Meo remains fully liable to the Client for the acts and omissions of its Subsequent Vendors

8.3 Notice of change: Meo will inform the Client by email at least thirty (30) days before authorizing a new Subsequent Vendor to process Client Data. The Client may object in writing within that period. If a reasonable objection is left unresolved, the Client may terminate the affected Services.

8.4 List of current vendors

For the up-to-date list of our vendors, see our privacy policy.

Some Subsequent Vendors (Stripe, Postmark) may process limited Personal Information in the United States. For those transfers:

• Data processing agreements are in place with each Subsequent Vendor
• The level of protection is equivalent to or higher than the level required by Applicable Law
• Meo provides the Client with the information needed to carry out the privacy impact assessment (PIA) required by section 17 of P-39.1

On request, Meo makes available detailed documentation of its security measures and those of its Subsequent Vendors in order to make it easier for the Client to complete its PIA.

Meo will assist the Client, as far as possible and taking into account the nature of the processing, so that it can respond to requests from individuals exercising their rights under Applicable Law:

The Client remains responsible for responding to requests from the individuals concerned within the thirty (30) day period provided for by Applicable Law.

Meo cooperates with the Client in carrying out the privacy impact assessments (PIAs) required by section 3.3 of P-39.1, by providing:

• The technical security documentation for the Services
• Information on the location of the processing and on the Subsequent Vendors
• The available compliance and audit reports (SOC 2, penetration tests)
• Any other reasonably necessary information

In accordance with section 18.3, paragraph 2, subparagraph (2) of P-39.1, Meo will not retain Client Data after the expiry or termination of the Terms.

The Client undertakes to:

• Designate a Privacy Officer for the protection of personal information in accordance with section 3.1 of P-39.1 and provide Meo with their contact details
• Make sure that the Personal Information transmitted to Meo was collected in accordance with Applicable Law, including obtaining the necessary consents
• Carry out the privacy impact assessments (PIAs) required by Applicable Law, in particular in the case of a transfer outside Quebec (section 17 of P-39.1)
• Respond to requests from the individuals concerned within the time limits prescribed by Applicable Law

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms, unless Applicable Law provides otherwise.

Meo remains liable for the acts and omissions of its Subsequent Vendors in the processing of Client Data.

This DPA takes effect on the date the Client accepts the Terms and stays in force for as long as Meo processes Client Data on behalf of the Client.

The provisions relating to confidentiality, to the destruction of data and to liability survive termination.

Meo may amend this DPA to reflect legislative, regulatory or operational changes. In the case of a substantial amendment, Meo will inform the Client by email at least thirty (30) days before it takes effect.

If the Client does not accept the amendment, it may terminate the Services before the date on which the amendment takes effect.

This DPA is governed by the laws of Quebec and the laws of Canada applicable therein. Any dispute will be submitted to the exclusive jurisdiction of the courts of the judicial district of Québec.

For any question relating to this DPA or to the protection of Client Data: